Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
July 30, 2026
Amazon attributed debug and chalk npm hijack to North Korea’s Sapphire Sleet, elevating a supply chain attack previously seen as
Cybersecurity
Amazon Ties Debug, Chalk npm Hijacks to North Korean Group
Amazon attributed debug and chalk npm hijack to North Korea's Sapphire Sleet, elevating a supply chain attack previously seen as financially motivated.
Cisco Secure FMC Zero-Day Added to CISA KEV Under Active Attack
CISA added the Cisco FMC zero-day CVE-2026-20316 to the KEV after active exploitation began. Cisco is also patching a critical FMC auth bypass rated CVSS ...
Critical Rails Active Storage Flaw Lets Attackers Read Server Files
The Rails framework patched CVE-2026-66066, a critical Active Storage flaw letting unauthenticated attackers read server files via crafted image uploads.
CVSS 10.0 RufRoot Flaw Lets Attackers Hijack AI Agent Systems
Disclosed CVE-2026-59726 is a CVSS 10.0 Ruflo MCP flaw granting unauthenticated RCE on AI agent servers, with patch-resistant persistence in agent memory.
Russian Group Laundry Bear Exploited Exchange Zero-Day in OWA Attack
Russian state-sponsored group Laundry Bear used a half-click Exchange zero-day to deploy the OWAReaper backdoor with credential-rotation-proof persistence.
Health-ISAC Warns Healthcare Sector of Rising ShinyHunters Attacks
Health-ISAC warned of increased ShinyHunters attacks on healthcare using vishing to compromise SSO accounts and steal data from connected cloud platforms.
Nine-Year Fraud Campaign Cloned Russian Company Sites for Payments
Russian cybersecurity firm F6 disclosed a nine-year fraud campaign cloning industrial company websites to steal advance payments from international firms.
OpenAI’s Rogue AI Used JFrog Zero-Days to Breach Hugging Face
A new postmortem reveals OpenAI's rogue AI model exploited JFrog Artifactory zero-days to escape its sandbox and breach Hugging Face and four other services.
Check Point SmartConsole Auth Bypass PoC Elevates Active Exploit Risk
Rapid7 released a public PoC for CVE-2026-16232, a CVSS 9.3 Check Point SmartConsole authentication bypass already under active exploitation in the wild.
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to deanonymization.
Cisco Secure FMC Zero-Day Added to CISA KEV Under Active Attack
July 30, 2026
CISA added the Cisco FMC zero-day CVE-2026-20316 to the KEV after active exploitation began. Cisco is also patching a critical
Critical Rails Active Storage Flaw Lets Attackers Read Server Files
July 30, 2026
The Rails framework patched CVE-2026-66066, a critical Active Storage flaw letting unauthenticated attackers read server files via crafted image uploads.
CVSS 10.0 RufRoot Flaw Lets Attackers Hijack AI Agent Systems
July 30, 2026
Disclosed CVE-2026-59726 is a CVSS 10.0 Ruflo MCP flaw granting unauthenticated RCE on AI agent servers, with patch-resistant persistence in
Russian Group Laundry Bear Exploited Exchange Zero-Day in OWA Attack
July 30, 2026
Russian state-sponsored group Laundry Bear used a half-click Exchange zero-day to deploy the OWAReaper backdoor with credential-rotation-proof persistence.
Health-ISAC Warns Healthcare Sector of Rising ShinyHunters Attacks
July 30, 2026
Health-ISAC warned of increased ShinyHunters attacks on healthcare using vishing to compromise SSO accounts and steal data from connected cloud
Nine-Year Fraud Campaign Cloned Russian Company Sites for Payments
July 30, 2026
Russian cybersecurity firm F6 disclosed a nine-year fraud campaign cloning industrial company websites to steal advance payments from international firms.
OpenAI’s Rogue AI Used JFrog Zero-Days to Breach Hugging Face
July 29, 2026
A new postmortem reveals OpenAI’s rogue AI model exploited JFrog Artifactory zero-days to escape its sandbox and breach Hugging Face
Check Point SmartConsole Auth Bypass PoC Elevates Active Exploit Risk
July 29, 2026
Rapid7 released a public PoC for CVE-2026-16232, a CVSS 9.3 Check Point SmartConsole authentication bypass already under active exploitation in
Firefox JIT Flaw CVE-2026-10702 Exposes Tor Browser to Deanonymization
July 29, 2026
Nebula Security published a full browser-to-kernel exploit chain for Firefox CVE-2026-10702, a JIT flaw that exposes Tor Browser users to
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.